Its the default filter I downloaded from the Exim site. But yes, it runs
along those lines.
This is basically it:
if $header_content-type: matches
"(?:file)?name=(\"[^\"]+\\\\.(?:ad[ep]|ba[st]|c
hm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|p
if|r
eg|scr|sct|shs|url|vb[se]|ws[fhc])\")"
then
fail text "This message has been rejected because it has\n\
potentially executable content $1\n\
This form of attachment has been used by\n\
recent viruses or other malware.\n\
If you meant to send this file then please\n\
package it up as a zip file and resend it."
seen finish
endif
Looks like it should work, right? Has anyone else got it to work with Exim
4? And if so, could I have a look at their configuration file?
Regards
Tirone Nel
Network Administrator & Support
Club Leisure Group
http://www.clubleisure.co.za
+27 (0)31 717 7677
----- Original Message -----
From: "John Burnham" <jpb@???>
To: "Tirone Nel" <tirone@???>; <exim-users@???>
Sent: Wednesday, May 08, 2002 11:46 AM
Subject: Re: [Exim] Help with Exim 4.x & System Filter
>
>
> > Thanks. I tried that yesterday, but it made no difference! I'm
> using
> > procmail at the moment to filter the messages. The error about the
> possible
> > harmful attachment shows up in exim_mainlog, but doesn't email to
> the user
> > (and I don't think it blocks the mail), and if I take out the
> procmail
> > transport/router so that it is straight Exim delivering, the filter
> doesn't
> > stop the mail from going through anyway? Help!
>
> Well, what do you have in your exim filter ? Something like
> if $h_subject contains "foo" then
> fail text "go away"
> endif
> ?
> John
>
>
